# Values for the upstream cert-manager chart, nested under `cert-manager:`
# (the dependency's name in Chart.yaml).
cert-manager:
  crds:
    # cert-manager's CRDs (Certificate, ClusterIssuer, Order, Challenge...)
    # installed as part of this same Helm release, rather than as a
    # separate manual step. `installCRDs` is the older, deprecated name for
    # this same setting.
    enabled: true

  # Technitium serves a private, split-horizon ahmza.com zone, while DNS-01
  # challenge TXT records are created in the public Cloudflare zone. Use
  # public resolvers for ACME self-checks so cert-manager sees the same TXT
  # record Let's Encrypt sees; ordinary Pods still use normal cluster DNS.
  extraArgs:
    - --dns01-recursive-nameservers-only
    - --dns01-recursive-nameservers=1.1.1.1:53,8.8.8.8:53